Know what you share.

Your lockfile, step by step

We hold your lockfile in private object storage while we parse it, then delete the original file. Package names, exact versions, dependency scope, and report results stay for 30 days. Scheduled cleanup and storage lifecycle rules remove failed or abandoned uploads.

Deleted data may remain in restricted database recovery history for up to 30 additional days. Recovery history is used only for operational restoration, and restored data is subject to the same expiry and deletion rules.

What goes to OSV

We send package names and versions to OSV to look up known advisories. Your dependencies are never installed, and uploaded files are never executed. Checks through MCP do not create stored reports.

Who can see your report

Your report link gives anyone who has it access to affected packages and findings. The public report API does not return your full dependency inventory. Keep the link private if those findings reveal sensitive dependencies. Reports are excluded from search indexing and shared caches. Use your separate management key to delete a report.

Where the evidence comes from

The feed brings together the CVE List, OSV and its upstream databases, and CISA KEV. We preserve original records and references so you can trace each finding. Each source keeps its own license and attribution requirements.

• CVE Program terms
• OSV source databases and licenses
• GitHub Advisory Database — CC BY 4.0
• CISA Known Exploited Vulnerabilities catalog

What a result can tell you

A known match is a starting point for investigation; it does not prove your deployment is exploitable. No matches does not prove it is safe. We show source health, unsupported dependencies, and incomplete checks so you and your agent can assess the gaps. Advisory descriptions stay true to the source, without generated security conclusions.